Is CVE-2026-72601 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72601?

CVE-2026-72601 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-72601

Description

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.